Nginx代理jumpserver

部署 Nginx 服务

• 配置 Repo

[root@iZ2ze20kp0n3exw93yzsntZ ~]# vi /etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

• 安装 Nginx

[root@iZ2ze20kp0n3exw93yzsntZ ~]# yum install -y nginx

• 配置 Nginx

[root@iZ2ze20kp0n3exw93yzsntZ ~]# cp /etc/nginx/nginx.conf /etc/nginx/nginx.confback
[root@iZ2ze20kp0n3exw93yzsntZ ~]# > /etc/nginx/nginx.conf
[root@iZ2ze20kp0n3exw93yzsntZ ~]# vi /etc/nginx/nginx.conf


user nginx;
worker_processes auto;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;


events {
worker_connections 1024;
}

stream {
log_format proxy '$remote_addr [$time_local] '
'$protocol $status $bytes_sent $bytes_received '
'$session_time "$upstream_addr" '
'"$upstream_bytes_sent" "$upstream_bytes_received" "$upstream_connect_time"';

access_log /var/log/nginx/tcp-access.log proxy;
open_log_file_cache off;

upstream kokossh {
server 192.168.1.245:2222;
least_conn;
}

server {
listen 2222;
proxy_pass kokossh;
proxy_protocol on;
proxy_connect_timeout 1s;
}
}

http {
include /etc/nginx/mime.types;
default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile on;
#tcp_nopush on;

keepalive_timeout 65;

#gzip on;

include /etc/nginx/conf.d/*.conf;
}

[root@iZ2ze20kp0n3exw93yzsntZ ~]# echo > /etc/nginx/conf.d/default.conf
[root@iZ2ze20kp0n3exw93yzsntZ ~]# vi /etc/nginx/conf.d/jumpserver.conf

upstream jumpserver {
server 192.168.1.245:8080;
ip_hash;
}

upstream core {
server 192.168.1.245:8080 max_fails=1 fail_timeout=1s;
}

server {
listen 80;
server_name jump.centoscn.vip; # 自行修改成你的域名
return 301 https://$server_name$request_uri;
}

server {
listen 443 ssl;
server_name jump.centoscn.vip; # 自行修改成你的域名
ssl_certificate /etc/nginx/scs1611589437436/Nginx/server.crt; # 自行设置证书
ssl_certificate_key /etc/nginx/scs1611589437436/Nginx/server.key; # 自行设置证书
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;

client_max_body_size 4096m; # 录像上传大小限制

location /api/v1/terminal/ {
proxy_pass http://core/api/v1/terminal/;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_404;
proxy_next_upstream_tries 3;
}

location /media/ {
proxy_pass http://core/media/;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 http_404;
proxy_next_upstream_tries 3;
}

location / {
proxy_pass http://jumpserver;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log off;
}
}

• 启动

[root@iZ2ze5eakhpbms7qco8gcvZ Nginx]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@iZ2ze5eakhpbms7qco8gcvZ Nginx]# systemctl enable nginx
Created symlink from /etc/systemd/system/multi-user.target.wants/nginx.service to /usr/lib/systemd/system/nginx.service.
[root@iZ2ze5eakhpbms7qco8gcvZ Nginx]# systemctl start nginx

访问

• http://jump.centoscn.vip